Tweaking Optimizing Windows.pdf - GEGeek

There are three basic types of exploits that are used on TCP ports. The first is when someone sends many, many packets to your
machine so that it freezes or blue screens under the electronic onslaught. This is a form of a denial of service (DoS) attack. The
second is where they send a specially crafted packet that "overloads" the port, allowing them to either execute code or cause the
service/OS to crash. This is called a buffer overrun. The last is when you haven't properly secured your services, and they can
connect to your mail server, and then send commands to the OS under the credentials of the mail service. For the most part the last
is not something you need to worry about on a Windows 2000 workstation. These products can be configured to let you know about
all such noteworthy events, and they will make your home machine a lot safer from the malicious e-rabble in the process.
14. List connections to your machine
Type 'netstat -a' in a command prompt will tell you who if anyone is connected to your computer.
15. Test your network
Now that your network is set up and hopefully locked down, you can test it at a number of sites to see if you got the basics. Please
note that these do NOT mean that your workstation is secure, and do NOT assume that because you pass this no one can break into
your workstation. These are just tools letting you know that some of the most obvious exploits. Here are the sites.
http://grc.com/intro.htm
www.dslreports.com/r3/dsl/secureme
www.antionline.com/
16. Use NTFS
NTFS partitions offer access controls and protections that aren't available with the FAT, FAT32, or FAT32x file systems. Make sure
that all partitions on your server are formatted using NTFS. If necessary, use the convert utility to non-destructively convert your
FAT partitions to NTFS. Warning If you use the convert utility, it will set the ACLs for the converted drive to Everyone: Full Control.
Use the fixacls.exe utility from the Windows NT Server Resource Kit to reset them to more reasonable values. Also no dual booting.
17. Encryption
If you are using the NTFS file system you can encrypt files or folders so that they cannot be opened by other users. Open Windows
Explorer, and then browse to the file or folder to be encrypted. Right-click on the file/folder and click 'Properties'. On the 'General'
tab, click 'Advanced'. Select the 'Encrypt contents to secure data' check box. Encrypting a folder automatically encrypts all its
subfolders and files. The encryption of a file or folder is transparent to the person who encrypts it; that person can work with the file
without restriction. Encryption protects against others opening that file or folder.
Never leave sensitive material on your computer e.g. credit card numbers etc unless it is properly encrypted. Use PGP software
(Pretty Good Privacy, from Network Associates), to make an encrypted virtual drive. No one will be able to access the contents of
the PGP drive unless the proper password is entered. To be really, really safe encrypt the contents of the items you put into the
PGP drive once again. Never use the same password that you use for anything else for PGP. 95, 98 and NT passwords are very
easy to crack. Make sure that your passphrase for PGP is over 25 characters long and contain non asci characters (see next tip).
When making a new key make the new key 4096 bit and make sure that you use 256bit for the PGP Disc. Overkill I know but as
computers are getting faster and faster everyday the cracking of highly encrypted files comes that one bit closer.
18. Use strong passwords
Windows 2000 allows passwords of up to 127 characters. In general, longer passwords are stronger than shorter ones, and
passwords with several character types (letters, numbers, punctuation marks, and nonprinting ASCII characters generated by using
the ALT key and three-digit key codes on the numeric keypad - see further below for complete list of non ASCII characters) are
stronger than alphabetic or alphanumeric-only passwords. For maximum protection, make sure the Administrator account password
is at least nine characters long and that it includes at least one punctuation mark or nonprinting ASCII character in the first seven
characters. In addition, the Administrator account password should not be synchronized across multiple servers. Different
passwords should be used on each server to raise the level of security in the workgroup or domain.
Also try to avoid words that are used in the English dictionary. Its common sense but never write your password down, never type
your password in when someone is near by and never use passwords that have something in common with yourself e.g. if someone
liked Harleys they may have Harley Davidson as the passphrase !
There's a lot of discussion on how complex/long you should make your password. One common misconception about hacking an
account is that it is frequently done through brute force attacks. This is where a remote machine tries to log into your local one over
and over, trying a different password each time. Don't worry too much about this because there are only two accounts that
everyone has on their Windows 2000 workstation, Administrator (which you have renamed) and Guest (which you have disabled).
There is one big if. IF someone has access to the physical medium you are using to connect to another computer (i.e. they are on
the same Ethernet segment or sharing someplace else further down the line), they can attempt to sniff the packets off the wire.
Since computers use electricity to send information over a network (ok, some use light, but really, how many of you have fiber to
your desktop?), every computer on a network segment gets every packet passed on that segment (Unless you are switched to the
desktop). Usually network cards ignore information not intended for them, but people of a mischievous bent can install programs
that let them pick up and save information that is intended for other people's computers.
If you are using Telnet, FTP or clear text SMB connections (Some older network programs use this, SAMBA for instance), your
passwords are there for the taking. It's that simple, they just run the program and read it. Even worse, Windows 9X and NT (preservice
pack 4) defaults to using the LAN Manager hash to encrypt passwords. This was a decently secure way to do it back in the
day, but with today's powerful processors, programs like L0phtCrack can sniff and decode your NT/9X authentication session-in real
time. This is not a good thing. Fortunately for the security conscious Windows user, Microsoft has made NTLMv2 the standard
method of encryption for authentication for NT after SP4 and 2000 from the start. The gotcha is that if you are in communication
with a machine that only supports an older version, Windows 2000 will communicate in a way the older machine understands,
meaning a less secure method. The Windows 2000 CD has an update for Win9X that allows 9x to use NTLMv2.
It is found at Clients\Win9x\Dsclient.exe.
Remember, if your password is easy to guess, it doesn't matter how well encrypted it is, so use something unusual. Your phone
number from your childhood home, your aunt's last name, or anything else that is: